topic Re: Bad Dashboard Interaction: Form Input Derived Token and URL Input Arguments in Dashboards & Visualizations

Bad Dashboard Interaction: Form Input Derived Token and URL Input Arguments

kulick — Fri, 24 Jan 2020 20:44:53 GMT

I am having trouble supporting both URL link parameters for a form input/token and "derived" value tokens which are computed from the value of a form token. As an example, imagine that I have two tokens, tok and derived. The token derived is set when token tok is changed, as follows...

      <input token=“tok”>
        <label>Summary Interval</label>
        <choice value="10minute">10 minutes</choice>
        <choice value="1hour">1 hour</choice>
        <choice value="1day">1 day</choice>
        <default>1hour</default>
        <change>
          <condition value="10minute">
            <eval token="derived">minspan=10m</eval>
          </condition>
          <condition>
            <set token="derived"></set>
          </condition>
        </change>
      </input>

The problem comes when a user links to this dashboard setting tok to "10minute" in the URL (with something like "tok=10minute" in the args). In this case, it seems that the token derived will not be set at all, causing any dependent dashboard panels to wait on token input.

I can work around by computing derived in a search instead, but it sure is convenient to simply set such a related (derived) token right here in the token it depends on. Does this usage of a change clause in the input pretty much ensure that bookmarks and other URL links containing token tok will be a problem?

Re: Bad Dashboard Interaction: Form Input Derived Token and URL Input Arguments

to4kawa — Wed, 30 Sep 2020 03:49:02 GMT

Set_tokens_on_page_load

set <init>, how about this?

Re: Bad Dashboard Interaction: Form Input Derived Token and URL Input Arguments

niketn — Sun, 26 Jan 2020 17:15:15 GMT

@kulick do you have searchWhenChanged for input set to true and submitButton turned false?

Also instead of <eval> use <set> to set the derived token in your dashboard

<set token="derived">minspan=10m</set>

PS: I tried the following code and it worked fine.

Source Dashboard
Used to link to Destination dashboard with input token value form.tokSummary=10minutes set

<dashboard>
  <label>Source dashboard with time span</label>
  <row>
    <panel>
      <html>
        <a target="_blank" href="https://<yourSplunkServer>:<yourSplunkWebPort>/en-US/app/search/<yourDestinationDashboardName>?form.tokSummary=10minute">Click to Pass Span to destination dashboard</a>
      </html>
    </panel>
  </row>
</dashboard>

Destination Dashboard

<form>
  <label>Destination Dashboard with span input</label>
  <fieldset submitButton="false">
    <input type="dropdown" searchWhenChanged="true" token="tokSummary">
      <label>Summary Interval</label>
      <choice value="10minute">10 minutes</choice>
      <choice value="1hour">1 hour</choice>
      <choice value="1day">1 day</choice>
      <default>1hour</default>
      <change>
        <condition value="10minute">
          <set token="derived">minspan=10m</set>
        </condition>
        <condition>
          <set token="derived"> </set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
          | fields - _time
          | eval inputToken="$tokSummary$",derived="$derived$"</query>
        </search>
      </table>
    </panel>
  </row>
</form>

Re: Bad Dashboard Interaction: Form Input Derived Token and URL Input Arguments

kulick — Wed, 02 Dec 2020 16:13:10 GMT

Sorry for the slow reply and thanks for the code review. Definitely misused eval there in my example. I will use searchWhenChanged="true" in the future. Thanks!